Scriipt to get the userr permissions details for entire site collection

Question

Is there any way to get the user permissions ( only specific one user) from entire site collection?

it should include permission details for that user from all sub sites.

and result should be exported to CSV. Please help . It is SHarePOint 2016

Answer 1

Hi @sns,

According to my research and testing, you can use the following PowerShell code to get SharePoint permissions for a specific user:

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
 
#Function to retrieve Permission data
Function Get-PermissionInfo([String]$UserID, [Microsoft.SharePoint.SPSecurableObject]$Object)
{
    #Object Array to hold Permission data
    $PermissionDataCollection = @()
    if($Object)
    {
       #Determine the given Object type and Get URL of it
       switch($Object.GetType().FullName)
       {
           "Microsoft.SharePoint.SPWeb"  { $ObjectType = "Site" ; $ObjectURL = $Object.URL }
           "Microsoft.SharePoint.SPListItem"
           {
           if($Object.Folder -ne $null)
           {
               $ObjectType = "Folder" ; $ObjectURL = "$($Object.Web.Url)/$($Object.Url)"
           }
           else
           {
               $ObjectType = "List Item"; $ObjectURL = "$($Object.Web.Url)/$($Object.Url)"
           }
       }
       #Microsoft.SharePoint.SPList, Microsoft.SharePoint.SPDocumentLibrary, "Microsoft.SharePoint.SPPictureLibrary",etc
       default { $ObjectType = "List/Library"; $ObjectURL = "$($Object.ParentWeb.Url)/$($Object.RootFolder.URL)" }
    }
  
   #Get Permissions of the user on given object - Such as: Web, List, Folder, ListItem
   $UserPermissionInfo = $Object.GetUserEffectivePermissionInfo($UserID)
 
   #Iterate through each permission and get the details
   foreach($UserRoleAssignment in $UserPermissionInfo.RoleAssignments)
   {
        #Get all permission levels assigned to User account directly or via SharePOint Group
        $UserPermissions=@()
        foreach ($UserRoleDefinition in $UserRoleAssignment.RoleDefinitionBindings)
        {
            #Exclude "Limited Accesses"
            if($UserRoleDefinition.Name -ne "Limited Access")
            {
                 $UserPermissions += $UserRoleDefinition.Name
            }
        }
  
      #Determine Permissions granted directly or through SharePoint Group
      if($UserPermissions)
      {
          if($UserRoleAssignment.Member -is [Microsoft.SharePoint.SPGroup])  
          {
              $PermissionType = "Member of SharePoint Group: " + $UserRoleAssignment.Member.Name    
          }
      else
      {
            $PermissionType = "Direct Permission"
      }
        $UserPermissions = $UserPermissions -join ";" 
  
         #Create an object to hold storage data
         $PermissionData = New-Object PSObject
         $PermissionData | Add-Member -type NoteProperty -name "Object" -value $ObjectType
         $PermissionData | Add-Member -type NoteProperty -name "Title" -value $Object.Title
         $PermissionData | Add-Member -type NoteProperty -name "URL" -value $ObjectURL 
         $PermissionData | Add-Member -type NoteProperty -name "Permission Type" -value $PermissionType
         $PermissionData | Add-Member -type NoteProperty -name "Permissions" -value $UserPermissions
         $PermissionDataCollection += $PermissionData
       }   
    } 
    Return $PermissionDataCollection
  }
}
 
#Function to Generate Permission Report
Function Generate-PermissionReport($UserID, $WebAppURL, $ReportPath)
{
    #Output Report location, delete the file, If already exist!
    if (Test-Path $ReportPath)
     {
        Remove-Item $ReportPath
     }
   
    #Write Output Report CSV File Headers
    "Object, Title, URL, Permission Type, Permissions" | out-file $ReportPath
 
    ###Check Whether the Search Users is a Farm Administrator ###
    Write-host "Scanning Farm Administrators..."
    #Get the SharePoint Central Administration site
    $AdminWebApp = Get-SPwebapplication -includecentraladministration | where {$_.IsAdministrationWebApplication}
    $AdminSite = Get-SPWeb $AdminWebApp.Url
    $AdminGroupName = $AdminSite.AssociatedOwnerGroup
    $FarmAdminGroup = $AdminSite.SiteGroups[$AdminGroupName]
  
    #enumerate in farm adminidtrators groups
    foreach ($user in $FarmAdminGroup.users)
    {
      if($user.LoginName.Endswith($UserID,1)) #1 to Ignore Case
      {
       "Farm, $($AdminSite.Title), $($AdminWebApp.URL), Farm Administrators Group, Farm Administrator" | Out-File $ReportPath -Append
     }    
    }
  
   ### Check Web Application User Policies ###
  Write-host "Scanning Web Application Policies..."
  $WebApp = Get-SPWebApplication $WebAppURL
  
  foreach ($Policy in $WebApp.Policies)
  {
      #Check if the search users is member of the group
      if($Policy.UserName.EndsWith($UserID,1))
      {
         #Write-Host $Policy.UserName
         $PolicyRoles=@()
         foreach($Role in $Policy.PolicyRoleBindings)
         {
            $PolicyRoles+= $Role.Name +";"
         }
          #Send Data to CSV File
          "Web Application, $($WebApp.Name), $($WebApp.URL), Web Application Policy, $($PolicyRoles)" | Out-File $ReportPath -Append
      }
  }
 
    #Convert UserID Into Claims format - If WebApp is claims based! Domain\User to i:0#.w|Domain\User
    if($WebApp.UseClaimsAuthentication)
    {
        $ClaimsUserID = (New-SPClaimsPrincipal -identity $UserID -identitytype 1).ToEncodedString()
    }
     else
    {
        $ClaimsUserID = $UserID
    }
 #Get all Site collections of given web app
 $SiteCollections = Get-SPSite -WebApplication $WebAppURL -Limit All
 
    #Loop through all site collections
    foreach($Site in $SiteCollections)
    {
       Write-host "Scanning Site Collection:" $site.Url
       ###Check Whether the User is a Site Collection Administrator
       foreach($SiteCollAdmin in $Site.RootWeb.SiteAdministrators)
       {
          if($SiteCollAdmin.LoginName.EndsWith($ClaimsUserID,1))
          {
            "Site Collection, $($Site.RootWeb.Title), $($Site.RootWeb.Url), Site Collection Administrators Group, Site Collection Administrator" | Out-File $ReportPath -Append
          }    
      }
   
  #Get all webs
  $WebsCollection = $Site.AllWebs
  #Loop throuh each Site (web)
  foreach($Web in $WebsCollection)
  {
       if($Web.HasUniqueRoleAssignments -eq $True)
       {
          Write-host "Scanning Site:" $Web.Url
     
          #Get Permissions of the user on Web
          $WebPermissions = Get-PermissionInfo $ClaimsUserID $Web
      
          #Export Web permission data to CSV file - Append
          $WebPermissions |  Export-csv $ReportPath  -notypeinformation -Append
       }
     
    #Check Lists with Unique Permissions
    Write-host "Scanning Lists on $($web.url)..."
    foreach($List in $web.Lists)
    {
        if($List.HasUniqueRoleAssignments -eq $True -and ($List.Hidden -eq $false))
        {
             #Get Permissions of the user on list
             $ListPermissions = Get-PermissionInfo $ClaimsUserID $List
       
            #Export Web permission data to CSV file - Append
            $ListPermissions |  Export-csv $ReportPath -notypeinformation -Append      
        }
     
     #Check Folders with Unique Permissions
     $UniqueFolders = $List.Folders | where { $_.HasUniqueRoleAssignments -eq $True }                   
     #Get Folder permissions
     foreach($folder in $UniqueFolders)
     {
         $FolderPermissions = Get-PermissionInfo $ClaimsUserID $folder
     
         #Export Folder permission data to CSV file - Append
         $FolderPermissions |  Export-csv $ReportPath -notypeinformation -Append   
      }
     
     #Check List Items with Unique Permissions
     $UniqueItems = $List.Items | where { $_.HasUniqueRoleAssignments -eq $True }
     #Get Item level permissions
     foreach($item in $UniqueItems)
     {
         $ItemPermissions = Get-PermissionInfo $ClaimsUserID $Item
       
         #Export List Items permission data to CSV file - Append
         $ItemPermissions |  Export-csv $ReportPath -notypeinformation -Append   
     }
    }
  }
 }
 Write-Host Permission Report Generated successfully!
}
 
#Input Variables
$WebAppURL = "https://intranet.crescent.com"
$Userid ="Crescent\Salaudeen"
$ReportPath = "D:\Reports\PermissionRpt.csv"
 
#Call the function to generate user access report
Generate-PermissionReport $Userid $WebAppURL $ReportPath

More information for reference: SharePoint 2013 / 2016: Specific User Permission Analysis Report using PowerShell

Hope it can help you. Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---